dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa

Module Contents

Classes

LSADefaultPasswordKeyProviderPlugin

Windows LSA DefaultPassword key provider plugin.

Attributes

defaultpassword_def

c_defaultpassword

dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.defaultpassword_def = Multiline-String
Show Value
"""
struct DefaultPassword {
    DWORD   length;
    char    flags[4*3];
    WCHAR   data[length/2];
    char    checksum_or_guid[0x10];
};
"""
dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.c_defaultpassword
class dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword.DefaultPasswordKeyProvider

Windows LSA DefaultPassword key provider plugin.

__namespace__ = 'dpapi.keyprovider.defaultpassword.lsa'

Defines the plugin namespace.

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

keys() → collections.abc.Iterator[tuple[str, str]]

Yield Windows LSA DefaultPassword decrypted strings.

Extracts decrypted DefaultPassword values from the LSA.

References